The best way would be to send an email disguised as spam, and have the employee respond out of band with its contents without actually replying.

Bonus points for sending similar emails to random @company.com addresses so receiving the email alone doesn’t suggest involvement.